Tool · Playground

Build your own hash function

Pick a construction, pick a permutation primitive, dial state size and rounds. Watch the internal state evolve. Measure avalanche, hunt for birthday collisions, mount a length-extension attack on your own creation. Everything runs locally.

Construction

Primitive

State (bytes)Block (bytes)Rounds (6)Output (16 bytes)

Input message

digest5fc79e6000fe57d503bb3f31a74b5b17

Internal state per step

4 compression calls · 25 bytes wide

3db5888b5ffc91a253b43f6ee9878ca9b6bebff17dcee9d711

step 1

ad3d28949b9f0383bd1a4bdbb225ccf5d44ab8ff6e3f32eba1

step 2

beb9bc9241f461a884bb9a3ead8da174754e76d6fac69c6cf5

step 3

ee3c32d27918b58e9051a5e8e2647744dec87bd7cbf64527dc

step 4

5fc79e6000fe57d503bb3f31a74b5b176e0a4ffba5338966e1

Color = byte value (hue) × magnitude (lightness). Each row is the state after one compression call (MD/HAIFA) or one absorb/squeeze permutation (sponge).

What this is teaching

Construction matters as much as primitive. Sponge and HAIFA close length-extension by design; Merkle-Damgård lets the bare digest serve as a continuation state. Try the same primitive in MD vs sponge and compare.
Rounds buy diffusion. Drop rounds to 1-2 and watch avalanche crater. Real hashes use 24-80 rounds for a reason.
Linear primitives are weak alone.“XOR + rotate” alone is GF(2)-linear; non-linearity (S-box, Keccak χ) is what stops algebraic attacks.
Birthday cost is √N, not N. The collision finder lets you watch the 2^(b/2) bound show up: doubling truncation bits quadruples the work.
Bad hashes still “look random”.Hex output that “looks scrambled” tells you nothing. Measure: avalanche, distinguishers, collision cost.

See the production constructions at Merkle-Damgård animator and Sponge animator, and the formal length-extension demo at length-extension.

FAQ